Privacy

Rectify Labs Ltd, trading as Rectify Labs, operates Rectify and this website. We are registered in England and Wales under company number 17418931, at Chandlers Yard, 24 Upper High Street, Worthing, BN11 1DL. This notice explains what we do with personal data, and what you can ask us to do about it.

Two roles, and which one applies

We do two different jobs with data, and different rules apply to each.

• Your account. When you sign up, we decide what to collect and why. For your account, your subscription and the emails we send you, we are the data controller.
• Your project content. The projects, snags, photos, notes and comments your organisation puts into Rectify are yours. You decide what goes in and why. We hold it and act on your instructions, so for that content your organisation is the controller and we are the processor.

The split matters when someone asks to see or delete something. If a company using Rectify assigned you a snag, that company answers for what is written in it, and we help them answer. If you need a written data processing agreement for your own compliance records, email support@rectifyapp.co and we will send you one.

What we collect

Your account

Your email address, your name if you give one, and a password. The password is stored as a hash by our authentication provider and is never visible to us, so we cannot tell you what it is and will never ask for it. We also hold which organisations you belong to and your role in each one, meaning owner, member or assignee. One person can be in several: an assignee working for more than one firm is the ordinary case.

What you put in the app

Project and snag titles and descriptions, comments, status changes, and the photos you attach. Photos are personal data whenever a person is in them, and they can carry metadata of their own, including when and where they were taken. Assigning a snag records who assigned it and to whom.

Billing

If your organisation subscribes, we hold the identifiers Stripe gives us for your customer and subscription record, which plan you are on and how many seats you bought. We never see or store card details. Those go directly to Stripe and stay there.

Email you send us, and email we send you

Support correspondence, and the replies you send to snag notification emails, which are matched back to the snag they belong to and stored as a comment on it. We also hold the delivery record for mail we send you, meaning whether it arrived, bounced or was reported as spam.

The launch list

If you ask to hear when Rectify launches, we hold your email address, the date you asked, and which version of the wording you agreed to. Nothing else: no IP address, no browser details. It is not passed to anyone.

We will send one message, on the day Rectify reaches the App Store, and it carries an unsubscribe link. Until then there is nothing to unsubscribe from, so if you change your mind before launch, email support@rectifyapp.co and we will delete your address.

Why we collect it, and our lawful basis

• Running your account and the service, including notification email about snags assigned to you. Lawful basis: contract.
• Taking payment and keeping billing records. Lawful basis: contract, and legal obligation for the records we have to keep for tax and company law.
• Keeping the service secure, which covers abuse prevention, diagnosing faults and keeping backups. Lawful basis: legitimate interests, being our interest in a service that works and does not leak.
• Answering your support questions. Lawful basis: legitimate interests.
• Telling you when Rectify launches, if you asked us to. Lawful basis: consent, which you can withdraw at any time.

Where it is stored

The database, the files and the accounts all sit with Supabase in their Ireland region. Photos live in object storage in the same region. Access is enforced at the database itself by row-level security, so one organisation's projects cannot be read by another, and an assignee sees only the snags assigned to them. Traffic between the app and the service is encrypted in transit, and data is encrypted at rest by our hosting provider.

Email is sent and received through Amazon SES in their London region, which is in the UK. That covers sign-in mail, snag notifications, and the delivery records for both.

The launch list is the one exception. Until Rectify launches it sits in Cloudflare D1, a database attached to the same service that serves this website, in their Western Europe region. At launch those addresses move into Supabase alongside the accounts, and the Cloudflare copy is deleted.

How long we keep it

• While your account is open, we keep your account and your organisation's content so the service works.
• When you close your account, we delete it and the content it owns straight away, not on a schedule. If you own an organisation, that organisation and everything in it goes with it. Work you did in someone else's organisation stays with them, without your name on it.
• Backups are kept on a rolling 30 day window, so deleted data can persist in a backup for up to 30 days after it goes from the live service. We do not restore backups to bring back deleted accounts.
• Billing records are kept for six years after the end of the financial year they fall in, because tax and company law require it.
• Support email is kept for two years.
• Email delivery records are kept for 90 days. They exist so we can tell whether a notification reached you, and so we can stop sending to an address that keeps bouncing.
• Launch list addresses are kept until the launch announcement has gone out, and then for 90 days after launch, so we can see how many of the people who asked to hear went on to sign up. They are deleted at the end of that period. Unsubscribe, or ask us sooner, and yours goes straight away.

Who we share it with

We do not sell personal data and we do not share it for anyone else's marketing. We use these processors, each doing one job:

• Supabase, for the database, file storage and accounts.
• Amazon Web Services, for sending and receiving email, including sign-in mail and snag notifications, and for the delivery records that go with them.
• Stripe, for taking payment and holding the card details we never see.
• Cloudflare, which serves this website and holds the launch list until Rectify launches. It sets no cookies and runs no analytics.
• Apple, which distributes the app. Apple's own terms cover the download itself. If you have agreed in your iOS settings to share analytics with developers, Apple passes us aggregate figures that do not identify you.

We would also disclose data if the law required it, or to take or defend a legal claim.

Transfers outside the UK

Email stays in the UK. Your content is held in Ireland, and the launch list in Cloudflare's Western Europe region; both sit inside the European Economic Area, which the UK recognises as providing an adequate level of protection. Some of our providers are US companies whose staff may access data in support of the service. Where that happens, the transfer is covered by the UK Addendum to the European Commission's standard contractual clauses in our contract with that provider.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct it if it is wrong;
• delete it;
• restrict what we do with it, or object to it;
• send it to you or to someone else in a portable format;
• stop, where we relied on your consent, by withdrawing it.

To delete your account, use the delete option in the app's settings. It takes effect immediately and cannot be undone. For anything else, email support@rectifyapp.co. We answer within one month and there is no charge.

If you own an organisation, deleting your account also deletes that organisation and everything in it: every project, snag, comment and photo, and everyone else's access to it. There is no way to hand an organisation to someone else, so an owner cannot close their account without taking the workspace with them. Export anything you or your colleagues want to keep first. If the organisation has a subscription, it is cancelled at the same time.

Work you did in someone else's organisation stays there. If you were assigned snags by a company using Rectify, the snags you raised and the comments and photos you added belong to that company's records, not to your account, and deleting your account does not remove them. What goes is your name: your authorship is cleared, so the entries remain without being attributed to you. This follows from the two roles set out at the top: that content is theirs, and we hold it on their instructions.

If you want that content removed as well, send the request to that organisation, because they decide what happens to it. Tell us too and we will point you at the right contact.

Cookies and analytics

This site sets no cookies, runs no analytics and carries no third-party scripts. The app carries no advertising or tracking software. If that ever changes, this section changes with it and you will see a cookie banner before anything is set.

Our billing site, where an account owner signs in to subscribe, keeps your sign-in session in your browser's local storage. That is what stops it asking you to sign in on every page, it is not analytics, and clearing your browser data removes it. Payment itself happens on Stripe's own pages, which set what Stripe needs to take a payment safely.

Children

Rectify is a tool for work and is not intended for anyone under 18. We do not knowingly collect data about children.

Changes to this notice

When we change it, the date at the bottom of this page changes. If a change materially affects you, we will email account holders rather than rely on you noticing.

Complaints

Come to us first at support@rectifyapp.co and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.

Contact

Questions about any of this go to support@rectifyapp.co, or by post to Rectify Labs Ltd, Chandlers Yard, 24 Upper High Street, Worthing, BN11 1DL.